Buggy code:
public boolean isPointerOnHeapRequired ( ) { } public Set < PRIMITIVE > getDataOnHeapRequired ( ) { } public boolean isMemoryModelInfrastructureRequired ( ) { } public boolean require ( MemoryHandler . MemoryModelDeclarations mmdecl ) { } public Set < MemoryHandler . MemoryModelDeclarations > getRequiredMemoryModelDeclarations ( ) { } } public Expression calculateSizeOf ( ILocation loc , CType cType ) { } public ArrayList < Declaration > declareMemoryModelInfrastructure ( final Dispatcher main , final ILocation tuLoc ) { } private VariableDeclaration constuctLengthArrayDeclaration ( ) { } private VariableDeclaration constructValidArrayDeclaration ( ) { } private VariableDeclaration constructNullPointerConstant ( ) { } private List < Declaration > declareUltimateMeminit ( Dispatcher main , Collection < HeapDataArray > heapDataArrays ) { } public CallStatement constructUltimateMeminitCall ( ILocation loc , Expression amountOfFields , Expression sizeOfFields , Expression product , Expression pointer ) { } private ModifiesSpecification announceModifiedGlobals ( String proc , Collection < HeapDataArray > heapDataArrays ) { } private List < Declaration > declareMemcpy ( Dispatcher main , Collection < HeapDataArray > heapDataArrays ) { ArrayList < Declaration > memCpyDecl = new ArrayList < > ( ) ; ILocation ignoreLoc = LocationFactory . createIgnoreCLocation ( ) ; String memcpyInParamSize = SFO . MEMCPY_SIZE ; String memcpyInParamDest = SFO . MEMCPY_DEST ; String memcpyInParamSrc = SFO . MEMCPY_SRC ; String memcpyOutParam = SFO . RES ; VarList inPDest = new VarList ( ignoreLoc , new String [ ] { memcpyInParamDest } , main . typeHandler . constructPointerType ( ignoreLoc ) ) ; VarList inPSrc = new VarList ( ignoreLoc , new String [ ] { memcpyInParamSrc } , main . typeHandler . constructPointerType ( ignoreLoc ) ) ; VarList inPSize = new VarList ( ignoreLoc , new String [ ] { memcpyInParamSize } , m_TypeHandler . ctype2asttype ( ignoreLoc , m_TypeSizeAndOffsetComputer . getSize_T ( ) ) ) ; VarList outP = new VarList ( ignoreLoc , new String [ ] { memcpyOutParam } , main . typeHandler . constructPointerType ( ignoreLoc ) ) ; VarList [ ] inParams = new VarList [ ] { inPDest , inPSrc , inPSize } ; VarList [ ] outParams = new VarList [ ] { outP } ; List < VariableDeclaration > decl = new ArrayList < > ( ) ; CPrimitive sizeT = m_TypeSizeAndOffsetComputer . getSize_T ( ) ; String loopCtr = main . nameHandler . getTempVarUID ( LOOPCTR , sizeT ) ; ASTType astType = m_TypeHandler . ctype2asttype ( ignoreLoc , sizeT ) ; VarList lcvl = new VarList ( ignoreLoc , new String [ ] { loopCtr } , astType ) ; VariableDeclaration loopCtrDec = new VariableDeclaration ( ignoreLoc , new Attribute [ 0 ] , new VarList [ ] { lcvl } ) ; decl . add ( loopCtrDec ) ; List < Statement > loopBody = constructMemcpyLoopBody ( heapDataArrays , loopCtr , memcpyInParamDest , memcpyInParamSrc ) ; IdentifierExpression memcpyInParamSizeExpr = new IdentifierExpression ( ignoreLoc , memcpyInParamSize ) ; Expression one = m_ExpressionTranslation . constructLiteralForIntegerType ( ignoreLoc , m_ExpressionTranslation . getCTypeOfPointerComponents ( ) , BigInteger . ONE ) ; List < Statement > stmt = constructCountingLoop ( memcpyInParamSizeExpr , loopCtr , one , loopBody ) ; Body procBody = new Body ( ignoreLoc , decl . toArray ( new VariableDeclaration [ decl . size ( ) ] ) , stmt . toArray ( new Statement [ stmt . size ( ) ] ) ) ; ArrayList < Specification > specs = new ArrayList < > ( ) ; <START_BUG> ModifiesSpecification modifiesSpec = announceModifiedGlobals ( MEMCPY , heapDataArrays ) ; <END_BUG> specs . add ( modifiesSpec ) ; addPointerBaseValidityCheck ( ignoreLoc , memcpyInParamDest , specs ) ; addPointerBaseValidityCheck ( ignoreLoc , memcpyInParamSrc , specs ) ; Expression memcpyParamSizeExpr = new IdentifierExpression ( ignoreLoc , memcpyInParamSize ) ; checkPointerTargetFullyAllocated ( ignoreLoc , memcpyParamSizeExpr , memcpyInParamDest , specs ) ; checkPointerTargetFullyAllocated ( ignoreLoc , memcpyParamSizeExpr , memcpyInParamSrc , specs ) ; EnsuresSpecification returnValue = new EnsuresSpecification ( ignoreLoc , true , ExpressionFactory . newBinaryExpression ( ignoreLoc , COMPEQ , new IdentifierExpression ( ignoreLoc , memcpyOutParam ) , new IdentifierExpression ( ignoreLoc , memcpyInParamDest ) ) ) ; specs . add ( returnValue ) ; Procedure memCpyProcDecl = new Procedure ( ignoreLoc , new Attribute [ 0 ] , MemoryHandler . MemoryModelDeclarations . C_Memcpy . getName ( ) , new String [ 0 ] , inParams , outParams , specs . toArray ( new Specification [ specs . size ( ) ] ) , null ) ; memCpyDecl . add ( memCpyProcDecl ) ; Procedure memCpyProc = new Procedure ( ignoreLoc , new Attribute [ 0 ] , MemoryHandler . MemoryModelDeclarations . C_Memcpy . getName ( ) , new String [ 0 ] , inParams , outParams , null , procBody ) ; memCpyDecl . add ( memCpyProc ) ; return memCpyDecl ; } public CallStatement constructMemcpyCall ( ILocation loc , Expression dest , Expression src , Expression size , String resVarId ) { } private ArrayList < Statement > constructCountingLoop ( Expression loopBoundVariableExpr , String loopCounterVariableId , Expression loopCounterIncrementExpr , List < Statement > loopBody ) { } private ArrayList < Statement > constructMemcpyLoopBody ( Collection < HeapDataArray > heapDataArrays , String loopCtr , String destPtr , String srcPtr ) { } private ArrayList < Statement > constructMemsetLoopBody ( Collection < HeapDataArray > heapDataArrays , String loopCtr , String ptr , Expression valueExpr ) { } private PRIMITIVE getCprimitiveThatFitsBest ( List < ReadWriteDefinition > test ) { } private List < Declaration > declareMemset ( Dispatcher main , Collection < HeapDataArray > heapDataArrays ) { } private VariableDeclaration constructMemoryArrayDeclaration ( final ILocation loc , final String typeName , final ASTType astType ) { } private List < Declaration > constructWriteProcedures ( ILocation loc , Collection < HeapDataArray > heapDataArrays , HeapDataArray heapDataArray ) { } private List < Declaration > constructReadProcedures ( ILocation loc , HeapDataArray heapDataArray ) { } private Procedure constructWriteProcedure ( final ILocation loc , final Collection < HeapDataArray > heapDataArrays , final HeapDataArray heapDataArray , ReadWriteDefinition rda ) { }

Fix:
ModifiesSpecification modifiesSpec = announceModifiedGlobals ( MemoryHandler . MemoryModelDeclarations . C_Memcpy . getName ( ) , heapDataArrays ) ;